PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42880 argoproj CVE debrief

Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes, has a critical vulnerability (CVE-2026-42880) in its ServerSideDiff endpoint. This vulnerability, with a CVSS score of 9.6, allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. The issue affects Argo CD versions from 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9. The vulnerability has been patched in versions 3.2.11 and 3.3.9. This issue is a result of a missing authorization and data-masking gap in the ServerSideDiff endpoint.

Vendor
argoproj
Product
argo-cd
CVSS
CRITICAL 9.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-07
Original CVE updated
2026-09-07
Advisory published
2026-05-07
Advisory updated
2026-09-07

Who should care

Users of Argo CD, especially those with read-only access, should be aware of this vulnerability and take immediate action to patch their systems. Kubernetes administrators and security teams should prioritize patching Argo CD instances to prevent potential data breaches. Additionally, defenders should review their inventory of Argo CD instances and monitor for any suspicious activity.

Technical summary

The vulnerability in Argo CD's ServerSideDiff endpoint allows an attacker to exploit a missing authorization and data-masking gap. This gap enables an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. The issue is caused by the lack of proper authorization and data masking in the ServerSideDiff endpoint. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The weakness associated with this vulnerability includes CWE-200, CWE-212, and CWE-201.

Defensive priority

High priority should be given to patching Argo CD instances to prevent exploitation of this vulnerability. Defenders should also review their inventory of Argo CD instances and monitor for any suspicious activity.

Recommended defensive actions

  • Patch Argo CD instances to versions 3.2.11 or 3.3.9.
  • Review inventory of Argo CD instances.
  • Monitor for suspicious activity.
  • Restrict access to the ServerSideDiff endpoint.
  • Implement additional security measures to protect Kubernetes Secret data.

Evidence notes

The CVE-2026-42880 vulnerability was published on May 7, 2026, and modified on June 30, 2026. The vulnerability affects Argo CD versions from 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9. The CVSS score for this vulnerability is 9.6, indicating a critical severity level.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42880 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42880

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42880 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42880

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3

    [email protected] - Exploit, Vendor Advisory

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHBA-2026:12433

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:20943

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:20947

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/security/cve/CVE-2026-42880

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.